What Is Data Anonymization

Back in 2006, AOL released around 20 million search queries to the research community. To ensure appropriate protection for its users, all usernames were removed and assigned a unique number. However, it took the New York Times’ reporters less than a week to work out who individual users were, most famously User No. 4417749. This is because her searches for landscapers in her town, home sales in her subdivision, and all the people who shared her last name all triangulated to one 62-year-old widow in Lilburn, Georgia.

This happened long before modern LLMs were a thing. Now, two decades later, the gap between “deidentified” and “anonymous” data has unrecognizably widened. A 2019 Nature Communications study found almost 99.98% of Americans could be correctly identified in any dataset using a simple 15-attribute demographic set, including ordinary info such as age, gender, and marital status. This represents a perilous danger, considering how IBM’s 2025 Cost of a Data Breach found that 53% of all breaches had customer PII as the most easily compromised data type, directly leading to $160 in costs per record.

The search logs of 2006 are today’s AI prompts, with trillions of datasets and RAG pipelines making it easier for malicious actors to peruse through millions of users’ data.

For enterprises both ethically and legally obligated to protect this information, data anonymization remains the most potent tool in doing so. Read on to learn exactly what data anonymization is, how it differs from pseudonymization and data masking, which techniques actually provide effective resilience against re-identification, and just what it takes to anonymize data at the enterprise scale.

Anonymization vs Pseudonymization vs Data Masking

While all three of these terms are often used interchangeably, they refer to different outcomes, techniques, and regulatory outcomes. As a result, the key distinction between the two comes down to just one question: can the data in question still be linked back to an individual using commercially available means?

At its core, anonymization refers to the irreversible transformation of personal data in a way the individual whose data it is can no longer be directly or indirectly identified. Different regulations view this sort of data differently, with the GDPR famously no longer considering such data to be “personal data”. However, the bar to be considered such data is high, with the tests evaluating not just the dataset itself but various other details such as additional information, technology, cost, and time an organization could reasonably need to re-identify someone.

Pseudonymization, on the other hand, replaces all direct identifiers, such as names, account numbers, or other personal information, with artificial values such as tokens or codes. The GDPR defines this technique as processing personal data so it can no longer be attributed to individuals without additional information, provided all such information is kept strictly separate and protected. However, additional information such as a key or lookup table can be used to decode pseudonymized data, making it personal data. Most privacy regulations recommend it as a security measure, but do not remove the relevant compliance obligations.

Lastly, data masking refers to a technical umbrella term rather than a legal category, as it obscures all sensitive values by substituting, shuffling, redacting, and partially hiding them. This allows for data to still be used safely in testing, development, customer support, and analytics without compromising its effectiveness or reliability. While dynamic masking hides values at query time while the original data stays intact, static masking permanently replaces all values in a copy of the dataset. As a result, data masking can contribute to anonymization, but only if no mapping back to the original values is retained and the remaining fields cannot be triangulated to identify an individual.

How Data Anonymization Works

Data anonymization does not refer to a single function that is run against a database, it’s a risk-based process that starts only before any data is transformed and continues after the data is shared.

Discover & Classify Personal Data

The first step is to build an accurate inventory of where personal and sensitive data lives. Through structured databases and data warehouses, including SaaS applications and unstructured data, an organization gains clear insights into what data it has and where.

Defined Purpose & Acceptable Risk

It is important to determine exactly what the anonymized data will be used for and who will receive it. A publicly published dataset means a completely different threat model than the one used by an internal analytics team under both contractual and technical controls.

Categorize Identifiers

All attributes in a dataset are different and require different treatment to ensure appropriate protection. Direct identifiers identify a personal directly, quasi-identifiers are harmless individually, but can be triangulated in combination, and sensitive attributes are the most desirable information for an attacker such as personal medical history or salary amounts.

Apply Anonymization

Organizations must then deploy and maintain whichever techniques and methods they deem most reliable and effective for their particular use cases. Since no single methods guarantees complete success, this combination allows for a balance between privacy and utility across every major attribute.

Test For Re-identification

Transformation on its own does not prove anonymity. European regulators general assess all anonymization against several risks such as singling out, linkability, and inferences.

Document, Govern, & Monitor

As new datasets are releases, likelihood of linkage increases. Moreover, AI-driven inference can make previously safe data identifiable. Hence, organizations should document every decision and its rationale, restrict access to such anonymized outputs, and prohibit any re-identification in data-sharing agreements.

Common Data Anonymization Techniques

Data anonymization does not rely on one single technique; rather, it relies on a combination of one or more of the following techniques being used in tandem.

Suppression & Redaction

Suppression leads to data being removed outright. This means an entire column with vital information is removed. Redaction applies the same principle to unstructured data by blacking out or deleting names, account numbers, or other key identifiers. However, despite their effectiveness, they lack nuance, as each value they suppress becomes lost for analysis.

Generalization (k-anonymity)

Generalization involves replacing precise values with broader ones. An exact age becomes an age band, a full ZIP code becomes just the first 3 digits. The goal is measured through something called k-anonymity, a model that ensures every record is at least indistinguishable from k-1 others on its quasi-identifiers. For example, in a 5-anonymous dataset, any combination of age band, region, and gender matches at least five people.

Aggregation

Aggregation involves replacing the individual-level records with summary statistics, such as totals, averages, and counts reported at the group level. This makes aggregation highly effective for reporting and dashboards.

Data Perturbation

Data perturbation means the modification of values ever so slightly so that the individual records no longer reflect exact values and truths, without compromising the dataset’s statistical properties. Common methods used in this way include adding random noise to numeric fields, rounding values, and micro aggregation, where each value is replaced with the average of a small group of similar records.

Data Swapping

Data swapping means exchanging the attribute values between records. Doing so ensures aggregate distributions are preserved, which is why national statistical agencies have long used this method to protect sensitive census and survey data.

Static Data Masking

Static data masking replaces sensitive values in a copy of the dataset with realistic but fictional alternatives, permanently. This method is widely used to give development, testing, and training teams production-like data without exposing any real customers. However, this method can only be effective under strict conditions, such as no mapping back to the original values being retained.

Synthetic Data

Synthetic data is artificially generated data meant to mirror the statistical patterns of a real dataset without containing any actual real records. It offers high utility with little to no privacy risk, as a GenAI model learns the distribution and relationships from the source data and produces entirely new records to be used for analytics and software testing.

Differential Privacy

Differential privacy is a mathematical framework that adds calibrated noise to the data or query results. Doing so ensures the output reveals little to nothing about whether any single individual’s records were included. Its biggest value proposition is the measurable privacy budget, expressed as epsilon, which quantifies exactly how much information can leak across all analyses.

Data Anonymization Under Different Regulations

A key challenge in effectively adopting data anonymization is just how differently various regulations treat it. Data that may be compliant in one jurisdiction would be in violation in another. Here’s how some of the major data regulations globally deal with it.

GDPR

The GDPR does not regulate any anonymous information at all. Data is outside its scope once the individuals are no longer identifiable. The test to determine this takes into account all the means an organization is likely to use, taking into account costs, time, and technology. However, pseudonymized data is still personal data, as the GDPR considers it more of a safeguard without removing the compliance obligations for the organizations deploying it.

In EDPS v. SRB (C-413/23 P), the CJEU added a critical nuance as the court held that pseudonymized data remains personal data for the organization holding the key. However, for a recipient with no realistic means of re-identifying individuals, it may not be personal data.

HIPAA

The term “de-identification” is used in HIPAA rather than anonymization, as any health information that is de-identified is no longer considered to be protected health information (PHI), provided it meets either of the two conditions:

• Safe Harbor which requires 18 specific identifiers to be removed.
• Expert Determination, where a qualified expert applies statistical and scientific methods to conclude the absence of risk of re-identification.

The aforementioned nuances are where regulatory challenges lie, as HIPAA allows re-identification codes to be retained. Hence, any data that is deidentified under HIPAA will still be considered pseudonymized data under GDPR.

CPRA

The CPRA categorically excludes deidentified information from its definition of personal information but attaches several conditions to it. Information is deidentified only if it can’t be used to infer information about or be linked to a specific consumer. Additionally, the organization holding this information must:

• Take reasonable measures to ensure it cannot be associated with the original consumer;
• Publicly commit to maintain it in its de-identified form;
• Contractually require all recipients to meet the same obligations.

Data Anonymization Challenges

While data anonymization is in itself an effective tool, it can be a sophisticated challenge to implement it at scale. Some of the key aspects of this challenge are as follows:

Re-identification Through Data Linkage

An anonymized dataset’s biggest vulnerability comes from everything that can be combined with it. Back in 2008, researchers were able to re-identify subscribers in the Netflix anonymous movie-ratings dataset by simply cross-referencing it with the public reviews on IMDb. Any new dataset published, breached, or sold expands the overall pool of information available to the attackers. Hence, a dataset that is completely safe and anonymous at release can become easily identifiable years later, without any changes to the data itself.

The Privacy-Utility Tradeoff

Every anonymization technique essentially removes information. However, this comes at the cost of reducing the overall analytical value. Aggressive generalization can lead to the dataset no longer being capable of accurately supporting the segmentation, forecasting, or model training it is meant for. On the other hand, underwhelming generalization can lead to failing the legal standards required. Hence, just finding the right balance requires understanding of both the data and the business purpose, a combination of privacy, data engineering, and domain expertise that very few teams have in place.

Unstructured & Dark Data

Structured databases have clear labeling of where data is. A column marked “email” will only contain emails. However, unstructured data lacks this clarity, with all details being embedded in one massive text blob. These data stores are rarely, if ever, inventoried. Hence, anonymizing such a dataset while that same personal data sits untouched in a ticket export or file share leaves the organization both operationally and legally exposed.

Data Sprawl Across Cloud & AI Pipelines

Personal data is rarely housed in just one place. It is copied multiple times into data lakes, replicated across cloud, and extracted into analytics sandboxes. Moreover, it is fed into AI pipelines as training data, fine-tuning sets, prompts, and vector embeddings for RAG. Each new copy is a new location where anonymization must be applied, and a potential point of failure if it isn’t. This also leads to a completely new form of risk, as models can memorize and reproduce personal data from training sets, with vector embeddings being inverted to recover the original text.

Inconsistent Standards Across Jurisdictions

There’s no single, defined meaning of “data anonymization”, as it can vary based on jurisdiction and context. The GDPR treats anonymization as an irreversible threshold that removes all data from its scope, while HIPAA offers two specific de-identification methods with their own criteria. Data that may satisfy one framework would fail another, meaning organizations operating across jurisdictions cannot follow one standard anonymization technique.

Manual & Inconsistent Processes

Most organizations continue to treat anonymization as a series of one-off projects. Each part of the overall task is done by a different team, relying on different techniques, and with little or no documentation. The results are inconsistent protection, no clear record of how anonymization was done, and no way to demonstrate compliance where required by regulators or auditors. Without automation and centralized policy enforcement, anonymization cannot be scaled with the rising volume and velocity of modern data.

How Securiti Works

Every anonymization technique discussed earlier depends on one thing: knowing exactly where the personal data is. Even the slightest bit of missing data, such as a misaligned column with birth dates in a data warehouse or an account number buried in a support ticket, and the dataset that was supposed to be anonymous no longer remains so.

Securiti, now a Veeam company, has a plethora of modules and solutions designed to cater to various data security, privacy, and governance needs. Its Data Discovery & Classification module, part of the wider DSPM offering, detects shadow and native data assets across AWS, Azure, Google Cloud, and Oracle Cloud Infrastructure. It then discovers, classifies, and labels hundreds of sensitive data elements across structured and unstructured systems at petabyte scale.

Consequently, teams get a comprehensive and searchable catalog that can show which sensitive data elements exist, where they’re stored, and which datasets carry the highest risk, broken down by data element, location, and user residency.

Request a demo today and see how DSPM can help your organization find and protect all the personal data an effective anonymization program relies on.

FAQs About Data Anonymization

Some of the most commonly asked questions related to data anonymization are as follows: